How it works

Most changes are standard: they need recording, not permission. For those, the whole lifecycle is two calls. The agent declares its intent:

The response comes back already signed: the record's hash, its position in the chain, and the key that signed it. When the work is done, a second call records the result the same way. The engine holds the signing keys and attributes each record to the accountable agent inside the signed payload, so agents never manage keys or assemble proof. Any process that speaks HTTP or MCP can do this, on any LLM and any platform.

A contract type declares what a class of change requires. Where the requirement is structural, an amount against an authority ceiling, a score against a band, the engine decides, and the routine path clears with no person in the loop. Where judgment is needed, the principal you designate renders accept or reject: a person, your own system of record, a rules engine, or a review agent you run. The ledger captures the verdict, holds it signed, and serves it to anything that checks for clearance before acting.

Either way it is a gate an agent can't talk its way past: the decision comes from the evidence, not from what the agent says about itself. The gated lifecycle is four signed steps:

When a record lands or a verdict is rendered, durable webhooks carry the outcome to the systems and people around the work, retried until delivery succeeds. Every delivery is signed: HMAC by default, Ed25519 HTTP Message Signatures when a receiver needs proof it can check against published keys. Settlement Signals ride the same channel.

Between the intent and the result, an agent can checkpoint its work state as typed records: objective, progress, decisions in force, resume instructions. A fresh session of the same agent reads the current checkpoint in one query and continues the work, no prior conversation needed. A handoff to a successor session is the same read, and because checkpoints are signed records on the chain, a fork or a stale head is visible instead of silently resumed from.

Each record is a COSE_Sign1 envelope over an in-toto statement, hash-linked to its predecessor. Export a chain, fetch the public keys from /.well-known/agledger-vault-keys.json, and anyone can confirm, with no access to the server, that every signature is genuine and every link unbroken. Alter one byte anywhere and verification fails. That is what makes the accumulated record a tamper-evident audit trail rather than a log: it builds itself while the agents run, and an auditor does not have to take your word for it.